Both the time-step size (recommended 30s, 60s isn't uncommon) and the validity window (+-1 (3 windows), +-2 (5 windows)) are configurable by the implementation. The time-step size can't be changed after the setup (both the server and the client would have to agree) and are visible to you. The validity window can be altered server side and isn't visible to a user. It's in the best interests of implementer to keep the validity window small since they have to check all valid TOTP codes for a client, but the phishing window while near-time, is larger than the time your code is visible.[0]

[0]: https://www.rfc-editor.org/rfc/rfc6238